> For the complete documentation index, see [llms.txt](https://reports.immunefi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://reports.immunefi.com/plume-or-attackathon/51180-sc-medium-function-is-vulnerable-to-gas-griefing.md).

# 51180 sc medium function is vulnerable to gas griefing

**Submitted on Jul 31st 2025 at 19:05:05 UTC by @PotEater for** [**Attackathon | Plume Network**](https://immunefi.com/audit-competition/plume-network)

* **Report ID:** #51180
* **Report Type:** Smart Contract
* **Report severity:** Medium
* **Target:** <https://github.com/immunefi-team/attackathon-plume-network/blob/main/plume/src/spin/Spin.sol>
* **Impacts:**
  * Theft of gas

## Description

### Brief / Intro

In the `Spin.sol` contract, the function `handleRandomness` contains a gas griefing attack vector due to an arbitrary external call (via a low-level call) that can trigger a malicious recipient's fallback/receive logic.

### Vulnerability Details

`handleRandomness` is intended to be called by the supra router to provide the random number and determine the reward. However, when certain reward categories are chosen the contract calls `_safeTransferPlume(user, rewardAmount * 1 ether);` which ultimately performs a low-level call to the user's address. Because this calls an arbitrary address, the recipient can execute arbitrary code in their `receive`/fallback function.

Code snippet:

```solidity
        if (
            keccak256(bytes(rewardCategory)) == keccak256("Jackpot")
                || keccak256(bytes(rewardCategory)) == keccak256("Plume Token")
        ) {
            _safeTransferPlume(user, rewardAmount * 1 ether);
        }
```

A malicious recipient can include gas-heavy computations in their fallback/receive to cause excessive gas consumption when the supra router triggers `handleRandomness`, resulting in the supra router paying for that gas — effectively a theft of gas.

### Impact Details

The supra router (the caller) must pay for any gas consumed during the external call. A malicious recipient can deliberately consume large amounts of gas in their fallback/receive, causing direct loss of funds for the supra router. This is a classic gas-griefing scenario.

### References

<https://github.com/immunefi-team/attackathon-plume-network/blob/580cc6d61b08a728bd98f11b9a2140b84f41c802/plume/src/spin/Spin.sol#L261>

## Proof of Concept

{% stepper %}
{% step %}

### Step

User requests a spin by calling `startSpin`.
{% endstep %}

{% step %}

### Step

Supra router calls `handleRandomness` to provide the random number and determine the reward.
{% endstep %}

{% step %}

### Step

The reward category for the user is "Plume Token" or "Jackpot", so `handleRandomness` invokes `_safeTransferPlume`, which performs a low-level call to the user's address.
{% endstep %}

{% step %}

### Step

The user-controlled address has a malicious `receive` or fallback function that performs gas-heavy computations. When called, this consumes excessive gas, which the supra router must pay — resulting in theft of gas.
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://reports.immunefi.com/plume-or-attackathon/51180-sc-medium-function-is-vulnerable-to-gas-griefing.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.